Search for:

After a slowdown in 2022 — US states are back at the drawing board of consumer privacy laws with four passing in the last month alone. Here, we breakdown what you need to know about the Montana and Tennessee bills.

In brief

The early months of 2023 have brought a bumper crop of new state privacy legislation, with Tennessee and Montana legislatures poised to become the eighth and ninth states to enact comprehensive privacy laws. The Tennessee Information Protection Act and Montana Consumer Data Privacy Act, which both passed with unanimous votes out of their respective legislatures on April 21, 2023, follow the recent passage of privacy laws in Iowa and Indiana. The bills now land on their governors’ desks for signature. While the bills hew to broad trends in state privacy laws, each contains novel provisions.

Some of their key distinguishing features include:

  • The new Montana law has lower than typical data-volume thresholds of applicability and will require businesses to acknowledge opt out preference signals after a sunrise period. Though the bill doesn’t provide for private enforcement, it doesn’t specify caps for monetary penalties.
  • The Tennessee law will require in-scope businesses to implement a data security program that “reasonably conforms to” the NIST Privacy Framework, and adhering to this framework can also give a business an affirmative defense to protect against claims under the new law.

If enacted, the Montana and Tennessee bills will enter into force on October 1, 2024 and July 1, 2025, respectively.

Click here to access full alert.


Cynthia Cole is an Intellectual Property Partner in Baker McKenzie's Palo Alto office, as well as a former CEO and General Counsel. Before joining the Firm, Cynthia was Deputy Department Chair of the Corporate Section in the California offices of Baker Botts where she built the technology transactions and data privacy practice. An intellectual property transactions attorney, Cynthia also has expertise in digital transformation, data privacy, and cybersecurity strategy. She advises clients across a wide range of industries including Technology, Media & Telecoms, Energy, Mining & Infrastructure, Healthcare & Life Sciences, and Industrials, Manufacturing & Transportation. Cynthia has deep experience in complex cross-border, IP, data-driven and digital transactions, creating bespoke agreements in novel technology fields. She acts as outside general counsel to a number of executive teams and boards of directors.


Helena Engfeldt is an associate in Baker McKenzie's International/Commercial Practice Group in San Francisco. Before joining the Firm, she was a Fellow at the Berkeley Center for Law and Technology. While attending Berkeley Law, Ms. Engfeldt was awarded the Dr. Tech. Marcus Wallenberg Foundation Fellowship and the Sweden America Foundation Fellowship.


Jonathan Tam is a licensed attorney in California and Ontario. He focuses on privacy, advertising, intellectual property, content moderation and consumer protection laws. He is passionate about helping clients achieve their commercial objectives while managing legal risks associated with activities involving data, information technology and media. Jonathan regularly writes about information technology and privacy, and is the Vice Chair of the Cybersecurity and Privacy Law Section of the Bar Association of San Francisco. He has completed secondments at a global payment services provider based in London, England and a world-leading tech company based in Silicon Valley. He joined Baker McKenzie as a summer associate in 2012 and has also worked in the Firm's Toronto office.

Write A Comment